EP3591893A1

EP3591893A1 - Method and system for providing security in trusted execution environments

Info

Publication number: EP3591893A1
Application number: EP19183659.2A
Authority: EP
Inventors: Ghassan KARAME; Claudio Soriente
Original assignee: NEC Laboratories Europe GmbH
Current assignee: NEC Corp
Priority date: 2018-07-06
Filing date: 2019-07-01
Publication date: 2020-01-08
Anticipated expiration: 2039-07-01
Also published as: EP3591893B1; US20200014546A1; US11362841B2

Abstract

A method secures a system that includes an application owner, a master application, and a plurality secure platforms. The master application receives from the application owner an application and an input. The application computes a function to calculate an output from the input. The master application deploys replicas of the application on a number of the secure platforms. The master application establishes a secure channel with each of the replicas, and sends at least a portion of the input to the replicas. The master application receives a result calculated by each of the replicas. The result is determined according to the function and the at least the portion of input. The master application determines the output based on the result received from each of the replicas; and sends to the application owner, the output.

Description

FIELD

The present invention relates to a method and system for providing security in trusted execution environments.

BACKGROUND

Trusted Execution Environments (TEEs), e.g., Intel SGX, allow for running applications in isolation from other software on the same host. Secret material, e.g., cryptographic keys for a given piece of code, are protected by the platform hardware and managed by secure mechanisms, e.g., sealing and encrypted memory. For example, application secret keys can be sealed (i.e., encrypted) at rest with keys only available to the platform hardware. At runtime, the application secret keys are unsealed and made available to the application. Encrypted memory ensures that such keys are only available in clear text within the processor and that they are encrypted when written to memory.
Keys in TEE applications may be used to for different security provisions. For example, a key may be used to sign the output of the application so that external entities can verify the authenticity of the output, i.e., that the output was produced by that specific TEE application. Alternatively, an encryption key may be used to encrypt the output so that it is only available to the intended recipient that holds the corresponding decryption key. Similarly, a key may be used by a TEE application either to decrypt incoming data or to verify its authenticity.
TEEs, including Intel SGX, are vulnerable to side-channel attacks. See, e.g., Ahmad Moghimi et al., "CacheZoom: How {SGX} Amplifies the Power of Cache Attacks," CHES 2017 (the entire contents of which are hereby incorporated by reference herein); Marcus Hähnel et al., "High-Resolution Side Channels for Untrusted Operating Systems," Usenix ATC 2017 ("Hähnel") (the entire contents of which are hereby incorporated by reference herein). Recently, an attack that leverages speculative execution of processors known as Spectre (see e.g., Paul Kocher et al., "Spectre Attacks: Exploiting Speculative
Execution," CoRR abs/1801.01203 2018 (the entire contents of which are hereby incorporated by reference herein)) was successfully adapted to Intel SGX to leak secrets of a victim TEE application (Guoxing Chen et al., "SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Execution," CoRR/abs/1802.09085, 2018 (the entire contents of which are hereby incorporated by reference herein)). Once the key has been leaked, any security provisions that relies on the secrecy of that key is invalidated. For example, if the key is used to sign the application output, the adversary may use the leaked key to sign arbitrary data on behalf of the application.
Patches and architectural changes are periodically issued to mitigate side-channels attacks. However, side-channels are an inherent aspect of platforms where multiple distrusting applications run, and a TEE architecture immune to side-channels is unlikely to appear on the market.

SUMMARY

In an embodiment, a method secures a system that includes an application owner, a master application, and a plurality secure platforms. The master application receives from the application owner an application and an input. The application is configured to compute a function to calculate an output from the input. The master application deploys replicas of the application on a number of the secure platforms. The master application establishes a secure channel with each of the replicas, and sends at least a portion of the input to the replicas. The master application receives a result calculated by each of the replicas. The result is determined according to the function and the at least the portion of input. The master application determines the output based on the result received from each of the replicas; and sends the output to the application owner.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be described in even greater detail below based on the exemplary figures. The invention is not limited to the exemplary embodiments. All features described and/or illustrated herein can be used alone or combined in different combinations in embodiments of the invention. The features and advantages of various embodiments of the present invention will become apparent by reading the following detailed description with reference to the attached drawings which illustrate the following:

FIG. 1 illustrates a system implementing an embodiment of the present invention;
FIG. 2 illustrates a method according to an embodiment of the present invention;
FIG. 3 illustrates another system implementing an embodiment of the present invention;
FIG. 4 illustrates another method according to an embodiment of the present invention; and
FIG. 5 is a block diagram of a processing system according to one embodiment of the present invention.

DETAILED DESCRIPTION

The present invention provides systems and methods that mitigate consequences of side-channel attacks in trusted execution environments (TEEs). Embodiments of the present invention solve, for example, the problem of leakage of secret material from TEEs, such as Intel SGX, via side-channels.
TEEs are susceptible to side-channel attacks that may leak secret material, e.g., private keys of an application running in a TEE. Leakage of the private key invalidates any security provisions that relies on the secrecy of such key. Despite a number of patches and architectural improvements aimed at countering side-channel attacks thus far available, it is unlikely that a traditional TEE immune to side-channels will be feasible in the near future. Embodiments of the present invention, however, provide an improvement over the state of the art by introducing techniques to create side-channel tolerant TEEs. For example, embodiments of the present invention overcome weaknesses of TEE applications related to side-channels by implementing mechanisms that provide desirable security provisions while tolerating side-channels.
A fundamental precondition of a successful side-channel attack is that the attacker co-locates with the victim, i.e., the victim application and the attacker's code run on the same platform. Embodiments of the invention, however, leverage replication and distribution of TEE applications on different platforms to mitigate the effectiveness of side-channel attacks. An adversary may still co-locate with some of the platforms where replicas of the victim application are running. The adversary may, therefore, leak the secrets of those application replicas by means of side-channel attacks. Yet, the adversary will not be able to invalidate the security provisions guaranteed by the secret keys of the application replicas, unless the adversary co-locates with all of the application replicas.
Embodiments of the current invention are discussed below in connection with a scenario where an application owner deploys a TEE application to compute a function f over owner-supplied inputs. That is, the TEE application computes and outputs y = f(x) where x is the input supplied by the application owner.
Embodiment of the present invention leverage seamless application replication in conjunction with cryptographic mechanisms to make the TEE applications robust to side-channels attack. In example embodiments, the application owner provides the code of the TEE application to a master application. The master application is a specialized TEE application that takes care of replicating the TEE application over several platforms and of coordinating the cryptographic protocols required.
An aspect of embodiments of the present invention is that, by using replication and threshold signature schemes, the consequences of a side-channel attack to TEE applications that require authenticated output data are mitigated.
Another aspect of embodiments of the present invention is that, by using replication and multi-party computation, the consequence of a side-channel attack to TEE applications that require confidential input and output data are mitigated.
For the present discussion, consider the scenario where the application owner requires the TEE application output to be authenticated by means of a signature scheme. In an embodiment of the present invention, the master application creates n replicas of the TEE application and distributes each replica on a different platform (e.g., a TEE enclave of a different platform). Further, the master application instantiates a t-out-of-n threshold signature scheme and provides each application replica with a share of the signing key. The corresponding verification key is supplied to the application owner. Each application replica receives the owner supplied input x, computes y = f(x), and uses its share of the signing key to compute a partial signature on y. Each application replica sends y and the partial signature to the master application. The master application checks that each application replica has returned the same value y. The master application then aggregates all partial signatures and forwards y and the aggregated signature to the application owner. The latter application owner may verify authenticity of y by verifying the aggregated signature using the verification key received by the master application.
As such, the adversary must launch a successful side-channel attack on at least t platforms to be able to sign arbitrary data on behalf of the application. In deployments, the threshold t of the signature scheme may be set to the number of platforms available (i.e., t = n), so that the adversary must launch a successful side-channel attack on all of the platforms in order to sign data on behalf of the TEE application.
In another embodiment, consider a scenario where the application owner requires input/output confidentiality by means of an encryption/decryption key. Here, a master application creates n replicas of the TEE application and distributes each replica on a different platform. The master application distributes encryption/decryption keys to the replicas in order to establish point-to-point confidential channels between any pair of replicas and between each replica and the master application. The master application may also create a confidential channel with the application owner by means of a shared key. Given the owner supplied input x, the master application computes random additive shares of x and distributes each share to each of the application replicas. The n replicas engage in a secure multi-party computation protocol so that each replica computes a random additive share of y = f(x). See Ivan Damgård et al., Multiparty Computation from Somewhat Homomorphic Encryption, CRYPTO 2012 (discussing multi-party computation, the entire contents of which are hereby incorporated by reference herein). Each application replica sends the random additive share of y to the master application. The master application recovers y by summing the additive shares and forwards the result to the application owner.
Since each application instance receives a random share of the input x, an adversary that successfully compromises the secret keys of up to n-1 replicas, does not learn any information on x. Further, because of the security provisions of secure multi-party computation, an adversary that compromises the secret keys of up to n-1 replicas learns nothing about y.
An embodiment of the present invention provides a method that secures a system that includes an application owner, a master application, and a plurality secure platforms. The master application receives from the application owner an application and an input. The application computes a function to calculate an output from the input. The master application deploys replicas of the application on a number of the secure platforms. The master application establishes a secure channel with each of the replicas, and sends at least a portion of the input to the replicas. The master application receives a result calculated by each of the replicas. The result is determined according to the function and the at least the portion of input. The master application determines the output based on the result received from each of the replicas; and sends the output to the application owner.
The method may further include: instantiating, by the master application a threshold signature signing scheme. The instantiating may include: distributing, by the master application, a respective share of a signing key of the threshold signature signing scheme to each of the replicas; and sending, by the master application, a verification key of the threshold signature signing scheme to the application owner; and receiving, by the master application from each of the replicas, a respective partial signature of the result calculated by the respective one of the replicas, the respective partial signature being based on the respective share of the signing key.
The master application may send the entire input to each of the replicas. The respective result received by the master application for each of the replicas may correspond to the output of the function applied to the input,
The method may further include: generating, by the master application, a reconstructed signature based on the respective partial signature received from each of the replicas; and outputting, by the master application, the reconstructed signature to the application owner. The reconstructed signature may be configured to be verified by the verification key. The respective result received by the master application for each of the replicas may be signed with the respective partial signature, and the output may be configured to be verified using the reconstructed signature and the verification key.
In an embodiment, the master application and the secure platforms are instantiated in trusted execution environment enclaves.
The method may further include receiving, by the master application, a replication parameter. The number of replicas and the number of security platforms may each correspond to the replication parameter.
In an embodiment, the number of secure platforms is at least two.
In an embodiment, the method further includes: respectively selecting, by the master application, a key for each pair of the replicas, and respectively sending, by the master application, the respective key to each pair of the replicas. The respective key may be configured to enable a secure channel between the respective pair of the replicas. In an embodiment, the key is a random key.
The method may further include: splitting, by the master application, the input into shares of the input. The at least a portion of the input respectively sent to each of the respective replicas may corresponds to one of the shares of the input. The respective result calculated by each of the replicas may be a partial result that is determined according to the function applied to the respective one of the shares of the input. The output may be determined by aggregating the partial result respectively received from each of the replicas.
According to an embodiment, he function is linear and the respective partial result received is calculated individually the respective one of the replicas.
In an embodiment, the function is non-linear and the respective partial result received is calculated based on a secure multi party protocol between the replicas.
Another embodiment of the present invention provides a secure platform having a processor coupled to a non-transitory storage memory containing instructions, which when executed by the processor, cause the secure platform to instantiate a master application in a secure enclave, the master application configured to perform the following operations: receive an application and an input, the application configured to compute a function to calculate an output from the input when executed; deploy a plurality of replicas of the application on a number of secure platforms; establish a secure channel with each of the replicas; send at least a portion of the input to the replicas; receive a result calculated by each of the replicas, the result being determined according to the function and the at least the portion of input; determine the output based on the result received from each of the replicas; and send to an application owner, the output.
The master application can be configured to utilize either a replication and threshold signature scheme or a replication and multi-party computation scheme to protect against side-channel attacks.
Another embodiment of the present invention provides a non-transitory computer-readable storage medium storing instructions that upon execution cause a master application, instantiated in a secure enclave, to perform the following operations: receive an application and an input, the application configured to compute a function to calculate an output from the input when executed; deploy a plurality of replicas of the application on a number of secure platforms; establish a secure channel with each of the replicas; send at least a portion of the input to the replicas; receive a result calculated by each of the replicas, the result being determined according to the function and the at least the portion of input; determine the output based on the result received from each of the replicas; and send to an application owner, the output.
An embodiment of the invention is based on the threshold version of the BLS signature scheme. More information on the BLS signature scheme can be found in: Dan Boneh et al., "Short Signatures from the Weil Pairing," ASIACRYPT 2001 , the entirety of which is incorporated by reference herein.
For a BLS signature scheme, let G be a Gap-Diffie-Hellman group-i.e., a group of prime order p with generator g and pairing operation e:GxG→G _T . Further, let H be a hash function that maps strings of arbitrary length to elements of G. The BLS signature scheme is a triplet of algorithms KeyGen, Sign, Verify, defined as follows:
KeyGen picks a random x in Z _p*, computes, and returns verification key vk= g ^x and signing key sk=x.
Sign takes as input a signing key sk and a message m, computes σ=H(m)^sk and returns σ.
Verify takes as input a verification key vk, a message m and a signature σ, and it returns 1 if e(σ,g)=e(H(m),vk) or 0 otherwise.
Threshold BLS signatures are described in Alexandra Boldyreva, "Threshold Signatures, Multisignatures and Blind Signatures Based on the Gap-Diffie-Hellman-Group Signature Scheme," Public Key Cryptography 2003 ("Boldyreva"), the entire contents of which are incorporated by reference herein.
For Threshold BLS signatures, given a BLS signature scheme (KeyGen, Sign, Verify) the threshold version has an additional triplet of algorithms: Share, Share-Sign, Reconstruct, defined as follows:
Share picks as an input a signing key sk and two values t, n where t ≤ n. It outputs n random key-shares sk ₁,...sk _n computed as follows. Pick at random t-1 coefficients a ₁,...,a _t-1 to define polynomial p(x) = sk + a ₁ x +a ₂ x ² +...a _t-1 x ^t-1. Set sk _i=p(i) for (≤ i ≤ n). If t = n, then sk ₁ ,...sk _n-1 are chosen at random and sk _n is set to sk _n = sk - (sk ₁ +...+ sk _n)
Share-Sign takes as an input a key-share sk _i and a message m, computes σ _i = H(m)sk _i and returns a signature-share σ _i.
Reconstruct takes as an input a set R of at least t signature-shares on a message m and outputs a signature σ = Π_i∈R(σ _i ^Li) where L _i is the appropriate Lagrange coefficient. If t = n, then we require |R|= n and the signature is computed as σ = Π_i∈R(σ _i)
Here, one designated party-known as the dealer-computes a key pair sk,vk by calling KeyGen. The dealer then computes n key-shares by calling Share on sk. Each key-share is given to a different signer. Each signer computes a signature-share on a message m by calling Share-Sign with input its key-share. Given at least t signature-shares on a message m, any party can reconstruct a valid signature σ on message m by calling Reconstruct. The signature output by Reconstruct can be verified with vk by calling Verify.
The security provisions of the threshold signature scheme guarantee that no coalition of up to t-1 holders of key-shares can produce a valid signature on arbitrary message m.
FIG. 1 illustrates an embodiment of a system for providing security in a TEE according to the present invention. As shown in FIG. 1, a system 100 may include an application owner 110 in communication with a master application 120, which in turn is in communication with at least one compute device 130 hosting at least one platform P. The application owner 110 and master application 120 may also be hosted on compute devices (e.g., personal computers, servers, IoT devices, mobile phones, etc.).
In one embodiment of the invention, the application owner 110 provides the master application 120 with a TEE application code A, an input x, and a replication parameter n.
For 1 ≤ i ≤ n, the master application 120 deploys the application A on the platform P _i. This is done by sending a replica of the application A to the platform P _i. The platform P _i., in turn, installs the application A in a local enclave 140 of the compute device 130 hosting the platform P _i. According to an embodiment, the local enclave 140 may be secure enclave such as provided by Intel SGX. A _i denotes the replica of the application A that runs in an enclave 140 on the platform P _i . As shown in the embodiment of FIG. 1, n = 3; thus the master application 120 deploys three replicas A ₁-A ₃ of the application A individually in the three platforms P ₁-P ₃.
According to an embodiment, n is at least two, such that at least two enclaves are used to ensure security against leakage.
The master application 120 also verifies that a replica A _i of the application A is running in an enclave 140 on each platform Pi by means of the remote attestation service. For example, an embodiment can use the remote attestation service of Intel SGX. Remote attestation also allows the master application 120 and the replica A _i of the application A to establish a confidential channel by means of a shared key. Any further communication between the master application 120 and any replica A _i of the application A happens over the corresponding confidential channel.
The master application 120 sets up a threshold signature scheme TS (see e.g., Boldyreva discussing threshold signature schemes) and runs TS.KeyGen to obtain a signing key sk and its corresponding verification key vk. The master application 120 calls TS.Share on the signing key sk to generate key-shares sk ₁ ,...sk _n , and provides each replica A _i with a corresponding key-share sk _i(1 ≤ i ≤ n). The verification key vk is provided to the application owner 100 by the master application 120.
The master application 120 forwards x to each application replica A _i. Each application replica A _i computes y = f(x), and uses its key-share sk _i to sign the outcome of its computation by calling TS.Share-Sign. That is, each application replica A _i outputs (y, σ _i), where σ _i is a partial signature over y computed by using sk _i.
The master application 120 collects (y, σ _i,..., σ _n), computes a reconstructed signature σ by calling TS.Reconstruct on the partial signatures σ _i,..., σ _n, and forwards (y, σ) to the application owner 110 who may verify authenticity of the reconstructed signature σ by using the verification key vk.
FIG. 2 illustrates a method 200 for providing security in trusted execution environments according to an embodiment of the present invention. In particular, the method 200 secures a trusted execution environment from, inter alia, a side channel attack. The method 200 may be operated in a system (such as system 100) that includes at least one application owner (such as application owner 110) at least one master application (such as master application 120), and a plurality of trusted execution environment enabled platforms (such as platform P _i). For example, there can be n SGX-enabled platforms, which may be at the application owner's premises or remote. Also, the master application may run on an additional TEE platform (i.e., a master trusted execution environment platform), such as an SGX-enabled platform.
In the method, the master application receives an application binary A and an input x from the application owner (S201). In an embodiment, the application binary A computes a function f to calculate and output y from the input x.
The master application deploys n replicas of application binary A over n different secure platforms (S202). The secure platforms include trusted execution environment enclaves; for example, the secure platforms may be SGX-enabled platforms.
The master application attests each replica and establishes a secure channel with each replica of the application binary A (S203).
The master application instantiates a threshold signature scheme and distributes shares of the signing scheme to the replicas (S204). The master application provides the verification key of the threshold signature scheme to the application owner (S205).
The master application sends the input x to each of the replicas (S206).
Each replica computes the output, i.e., y = f(x), and computes a partial signature of the output y using its share of the signing key (S207).
The master application receives each replica's output y and each replica's partial signature (S208).
The master application aggregates the partial signature into a standard signature (S209).
The master application sends the output y and the standard signature to the application owner (S210).
The application owner checks authenticity of the output y by verifying the standard signature using the verification key (S211).
Referring to FIG. 3, another embodiment of a system 300 according to the invention is illustrated. In the system 300, the application owner 310 provides the master application 320 with a TEE application code A, an input x, and a replication parameter n.
For 1 ≤ i ≤ n, the master application 320 deploys the application A on the platform P _i. This is done by sending a replica of the application A to the platform P _i. The platform P _i, in turn, installs the application A in a local enclave 340 of the compute device 330 hosting the platform P _i. A _i denotes the replica of the application A that runs in an enclave 340 on the platform P _i.
The master application 320 verifies that the replica A _i of the application A is running in an enclave 340 on the platform P _i by means of a remote attestation service. For example, an embodiment can use the remote attestation service provided by Intel SGX. Remote attestation also allows the master application 320 and the replica application A _i to establish a confidential channel by means of a shared key sk. Any further communication between the master application 320 and any application replica A _i happens over the corresponding confidential channel.
For each pair of application replicas A _i, A _j (1 ≤ i, j ≤ n), the master application 320 picks at random a key K _ij and distributes it to A _i and A _j. Any further communication between A _i and A _j happens over the confidential channel established by means of K _ij.
According to another embodiment, each pair of application replicas A _i, Aj (1 ≤ i, j≤n) may attest each-other by means of the remote attestation service, e.g., the remote attestation service of Intel SGX, in order to establish a confidential channel by means of a shared key. Any further communication between A _i and A _j happens over the confidential channel established.
In an embodiment, the master application 320 splits x in n additive random shares x ₁,...,x _n. This can be done, for example, by picking x ₁,...,x _n-1 at random and then setting x _n = x-(x ₁ +...+ x _n-1). The master application 320 sends share x _i to application replica A _i.
If f is linear, e.g., f = ax + b, then each replica A _i computes y' _i = f'(x _i)=ax _i , and outputs y' _i . The master application 320 computes y = Σ_i=1,...,n y'_i + b and sends it to the application owner 310. Here, the master application may be considered a trusted entity to act on behalf of the owner.
If f is non-linear, then all application replicas A _i engage in a secure multi-party computation protocol to compute linear shares of y = f(x). For example, the SPDZ framework can be used (see e.g., Hähnel discussing SPDZ). The SPDZ framework uses an offline phase where parties must compute shares of triplet a,b,c such that c = ab. In settings of embodiments, all such triplets can be defined, shared, and distributed by the master application 320 to the application replicas A _i . That is, given a random triplet a,b,c, the master application 320 computes n (linear) shares of a as a ₁ ,...,a _n and sends a _i to A _i. The same approach is used to compute and distribute shares of b and c. Once all triplets have been shared across the application replicas A _i, all of them move to the online phase of the SPDZ protocol to compute shares of y. Here, y' _i is the share of y held by the application replica A _i at the end of the online phase of the SPDZ protocol. A _i sends y' _i to the master application 320. The master application 320 aggregates (i.e., sums) all y' _i (1 ≤ i ≤ n) to recover y and forwards it to the application owner 310.
FIG. 4 illustrates a method 400 for providing security in trusted execution environments according to an embodiment of the present invention. In particular, the method 400 secures a trusted execution environment from, inter alia, a side channel attack. The method 400 may be operated in a system (such as system 300) that includes at least one application owner (such as application owner 310) at least one master application (such as master application 320), and a plurality of trusted execution environment enabled platforms (such as platforms P _i). For example, there can be n SGX-enabled platforms, which may be at the application owner's premises or remote. Also, the master application may run on an additional SGX-enabled platform.
In the method, the master application receives an application binary A and an input x from the application owner (S401). In an embodiment, the application binary A computes a function f to calculate and output y from the input x. The function f may be linear or non-linear.
The master application deploys n replicas of application binary A over n different secure platforms (S402). The secure platforms include trusted execution environment enclaves; for example, the secure platforms may be SGX-enabled platforms.
The master application attests each replica and establishes a secure channel with each replica of the application binary A (S403).
Each pair of replicas establishes a secure connection between them (S404). In an embodiment, the master application distributes a random key to each pair of replicas for establishing the secure channel (S404a). In an embodiment, each pair of replicas performs remote attestation to form the secure channel (S404b).
The master application splits the input x into n additive random shares, and sends a share to each of the replicas (S405).
Each replica computes its share of the output (S406). When the function f is linear, then each replica computes its share of the output separately (S406a). When the function f is non-linear, then all replicas engage in a secure multi-party computation protocol to compute their output shares (S406b). Once the output shares are computed, the output shares are sent to and received by the master application (S407).
The master application aggregates the output shares to compute the output (S408).
The master application sends the output to the application owner (S409).
FIG. 5 is a block diagram of a processing system according to one embodiment for providing a secure trusted execution environment. The processing system can be used to implement the system and method described above. For example, each of the platforms, the application owner, and master application may be implemented on a processing system such as shown in FIG. 5. Each processing system includes at least one processor 704, such as a central processing unit (CPU) of the computing device or a dedicated special-purpose processor, executes computer executable instructions comprising embodiments of the system for performing the functions and methods described above. In embodiments, the computer executable instructions are stored (e.g., locally stored) and accessed from a non-transitory computer readable medium, such as storage 710, which may be a hard drive or flash drive. Read Only Memory (ROM) 706 includes computer executable instructions for initializing the processor 704, while the random-access memory (RAM) 708 is the main memory for loading and processing instructions executed by the processor 704. The network interface 712 may connect to a wired network or cellular network and to a local area network or wide area network, such as the Internet.
While the invention has been illustrated and described in detail in the drawings and foregoing description, such illustration and description are to be considered illustrative or exemplary and not restrictive. It will be understood that changes and modifications may be made by those of ordinary skill within the scope of the following claims. In particular, the present invention covers further embodiments with any combination of features from different embodiments described above and below. Additionally, statements made herein characterizing the invention refer to an embodiment of the invention and not necessarily all embodiments.
The terms used in the claims should be construed to have the broadest reasonable interpretation consistent with the foregoing description. For example, the use of the article "a" or "the" in introducing an element should not be interpreted as being exclusive of a plurality of elements. Likewise, the recitation of "or" should be interpreted as being inclusive, such that the recitation of "A or B" is not exclusive of "A and B," unless it is clear from the context or the foregoing description that only one of A and B is intended. Further, the recitation of "at least one of A, B and C" should be interpreted as one or more of a group of elements consisting of A, B and C, and should not be interpreted as requiring at least one of each of the listed elements A, B and C, regardless of whether A, B and C are related as categories or otherwise. Moreover, the recitation of "A, B and/or C" or "at least one of A, B or C" should be interpreted as including any singular entity from the listed elements, e.g., A, any subset from the listed elements, e.g., A and B, or the entire list of elements A, B and C.

Claims

A method for securing a system comprising an application owner, a master application, and a plurality secure platforms, the method comprising:
receiving, by the master application from the application owner, an application and an input, the application configured to compute a function to calculate an output from the input when executed;

deploying, by the master application, a plurality of replicas of the application on a number of the secure platforms;

establishing, by the master application, a secure channel with each of the replicas;

sending, by the master application, at least a portion of the input to the replicas;

receiving, by the master application, a result calculated by each of the replicas, the result being determined according to the function and the at least the portion of input;

determining, by the master application, the output based on the result received from each of the replicas; and

sending, by the master application to the application owner, the output.
The method according to claim 1, the method further comprising:
instantiating, by the master application a threshold signature signing scheme, the instantiating comprising:
distributing, by the master application, a respective share of a signing key of the threshold signature signing scheme to each of the replicas; and

sending, by the master application, a verification key of the threshold signature signing scheme to the application owner; and

receiving, by the master application from each of the replicas, a respective partial signature of the result calculated by the respective one of the replicas, the respective partial signature being based on the respective share of the signing key;
The method according to claim 1 or 2,
wherein the master application sends the entire input to each of the replicas, and
wherein the respective result received by the master application for each of the replicas corresponds to the output of the function applied to the input,
The method according to claim 2, the method further comprising:
generating, by the master application, a reconstructed signature based on the respective partial signature received from each of the replicas; and

outputting, by the master application, the reconstructed signature to the application owner,

wherein the reconstructed signature is configured to be verified by the verification key,

wherein the respective result received by the master application for each of the replicas is signed with the respective partial signature, and

wherein the output is configured to be verified using the reconstructed signature and the verification key.
The method according to any of claims 1 to 4, wherein the master application and the secure platforms are instantiated in trusted execution environment enclaves.
The method according to any of claims 1 to 5, the method further comprising:
receiving, by the master application, a replication parameter,

wherein the number of replicas and the number of security platforms each correspond to the replication parameter.
The method according to any of claims 1 to 6, wherein the number of secure platforms is at least two.
The method according to any of claims 1 to 7, the method further comprising:
respectively selecting, by the master application, a key for each pair of the replicas, and

respectively sending, by the master application, the respective key to each pair of the replicas,

the respective key being configured to enable a secure channel between the respective pair of the replicas.
The method according to claim 8, wherein the key is a random key.
The method according to any of claims 1 to 9, the method further comprising:
splitting, by the master application, the input into shares of the input,

wherein the at least a portion of the input respectively sent to each of the respective replicas corresponds to one of the shares of the input, and

wherein the respective result calculated by each of the replicas is a partial result that is determined according to the function applied to the respective one of the shares of the input;

wherein the output is determined by aggregating the partial result respectively received from each of the replicas.
The method according to claim 10, wherein the function is linear and the respective partial result received is calculated individually the respective one of the replicas.
The method according to claim 10, wherein the function is non-linear and the respective partial result received is calculated based on a secure multi party protocol between the replicas.
A secure platform comprising a processor coupled to a non-transitory storage memory containing instructions, which when executed by the processor, cause the secure platform to instantiate a master application in a secure enclave, the master application configured to perform the following operations:
receive an application and an input, the application configured to compute a function to calculate an output from the input when executed;

deploy a plurality of replicas of the application on a number of secure platforms;

establish a secure channel with each of the replicas;

send at least a portion of the input to the replicas;

receive a result calculated by each of the replicas, the result being determined according to the function and the at least the portion of input;

determine the output based on the result received from each of the replicas; and

send to an application owner, the output.
The secure platform according to claim 13, wherein the master application is configured to utilize either a replication and threshold signature scheme or a replication and multi-party computation scheme to protect against side-channel attacks.
A non-transitory computer-readable storage medium storing instructions that upon execution cause a master application, instantiated in a secure enclave, to perform the following operations:
receive an application and an input, the application configured to compute a function to calculate an output from the input when executed;

deploy a plurality of replicas of the application on a number of secure platforms;

establish a secure channel with each of the replicas;

send at least a portion of the input to the replicas;

receive a result calculated by each of the replicas, the result being determined according to the function and the at least the portion of input;

determine the output based on the result received from each of the replicas; and

send to an application owner, the output.